Roundcube CVE-2026-48842: Pre-Auth SQL Injection in virtuser_query Now Exploited

TL;DR

What: The Canadian Cyber Centre reports active exploitation of CVE-2026-48842, a pre-auth SQL injection in the Roundcube Webmail virtuser_query plugin caused by a preg_replace() backslash escape bypass.
Impact: An unauthenticated attacker can run arbitrary SQL against the Roundcube database backend, exposing mail account credentials and stored message data.
Fix / mitigation: Upgrade to Roundcube 1.6.16 or 1.7.1 (released May 2026), or disable the virtuser_query plugin until you can.
Who's at risk: Organizations running Roundcube 1.6.x before 1.6.16 or 1.7.x before 1.7.1 with the virtuser_query plugin enabled, including hosting providers, universities and government mail.

A Roundcube Webmail bug patched four months ago is now being used in real attacks. The Canadian Centre for Cyber Security updated its advisory this week to say CVE-2026-48842 (CVSS 8.1) is being actively exploited in the wild, citing open-source reporting. The flaw is a pre-authentication SQL injection: no account, no session, no phishing step. If your Roundcube server runs an affected version with the virtuser_query plugin enabled, an attacker can reach your mail database from the login page.

What is affected

Roundcube Webmail 1.6.x before 1.6.16
Roundcube Webmail 1.7.x before 1.7.1
Only deployments that enable the virtuser_query plugin, which maps login names to mailbox identities through a SQL lookup
Fixed in 1.6.16 and 1.7.1, both released in May 2026

virtuser_query ships with Roundcube but is opt-in. It is common in hosting and multi-domain setups where the address a user types at login has to be resolved to a real mailbox or identity through a database table. That profile, many tenants behind one webmail front end, is also where a database dump does the most damage.

How the injection works

The plugin builds its lookup query by substituting the user-supplied login value into an administrator-defined SQL template. Before substitution, the input passes through a preg_replace() based escape routine. According to the advisory, attackers can defeat that routine with a crafted backslash sequence, so a quote character survives escaping and breaks out of the string literal. From there, the attacker appends arbitrary SQL.

Because the lookup runs while resolving the login name, it executes before any password check. SentinelOne summarized the result: unauthenticated attackers can inject SQL into Roundcube's database backend, potentially exposing mail account credentials and stored messages. What the attacker can read or write depends on the privileges of the database account Roundcube uses, which in many installs is broader than it needs to be.

Exploitation is confirmed, details are not

The Cyber Centre has not published indicators, actor names, or payloads for this campaign. Treat any unpatched server with virtuser_query enabled as potentially compromised, not just exposed, and review it accordingly.

Exposure by the numbers

Shadowserver Foundation data shows more than 523,000 Roundcube instances reachable from the internet. As of September 23, 2026, it flagged 10 of them as vulnerable to this CVE. That small number reflects what can be fingerprinted remotely: whether virtuser_query is enabled is not visible from the outside, so the true count of exploitable hosts is unknown. The number to care about is your own, and the check below answers it in under a minute.

Why Roundcube keeps getting hit

Webmail is a direct line to an organization's correspondence, and Roundcube sits at the edge on hundreds of thousands of servers. That makes it a recurring target:

February 2026: CISA added CVE-2025-49113 and CVE-2025-68461, both Roundcube flaws, to its Known Exploited Vulnerabilities catalog.
July 2026: Proofpoint reported a suspected China-aligned actor, tracked as UNK_MassTraction, exploiting known Roundcube vulnerabilities to drop web shells and the VShell post-exploitation tool.
September 2026: CVE-2026-48842 confirmed exploited, four months after the fix shipped.

The pattern is consistent. Actors are not waiting for zero-days. They work the gap between release and deployment, and Roundcube installs are often left on a distribution package or a hand-installed tarball that nobody owns.

What to do now

Inventory every Roundcube install, including distro packages under /usr/share/roundcube and tarball installs under /var/www.
Confirm the version. Anything on 1.6.x below 1.6.16 or 1.7.x below 1.7.1 is in scope.
Check whether virtuser_query appears in the plugins array or config. If it does, that host is exploitable until patched.
Upgrade to 1.6.16 or 1.7.1. If you run a distro package, confirm your vendor has shipped or backported the fix before trusting the package version.
If you cannot upgrade today, remove virtuser_query from the plugins list and reload PHP. Logins that depend on the mapping will break, which is the right trade-off against a pre-auth database read.
Reduce the Roundcube database account to the privileges it needs, and keep it off any database that also holds other application data.

If the host was exposed

Rotate the Roundcube database credentials and the des_key in config.inc.php, force password resets for mailbox users on that host, and search the web root for files you did not deploy, given that prior Roundcube campaigns dropped web shells.

Bottom line

CVE-2026-48842 is narrow in scope, one opt-in plugin, but severe where it applies: unauthenticated database access on the server holding your mail. The patch has been out since May. If you run virtuser_query, patch or disable it today, then look back through your logs for the window you were exposed.

Fix It Yourself

Everything above is what happened. This is what to run. The check commands change nothing.

Check whether you are exposed

Find every Roundcube install on this host and print its version

sudo find / -xdev -path '*program/include/iniset.php' -exec grep -H "RCMAIL_VERSION'" {} \; 2>/dev/null

Show whether the virtuser_query plugin or its config key is enabled

sudo grep -rnE "virtuser_query" /etc/roundcube /var/www/*/config /usr/share/roundcube/config /var/lib/roundcube/config 2>/dev/null

Check whether the plugin files are present at all

sudo find / -xdev -type d -path '*plugins/virtuser_query' 2>/dev/null

Close it

Download and unpack the fixed 1.6.16 release to /tmp (use 1.7.1 if you are on the 1.7 branch); changes nothing in production

cd /tmp && curl -fLO https://github.com/roundcube/roundcubemail/releases/download/1.6.16/roundcubemail-1.6.16-complete.tar.gz && tar xzf roundcubemail-1.6.16-complete.tar.gz

Upgrade a tarball install in place with Roundcube's own installer (prompts before writing; back up the web root and database first; adjust the target path)

cd /tmp/roundcubemail-1.6.16 && sudo ./bin/installto.sh /var/www/roundcube

Containment if you cannot upgrade today: back up config, remove virtuser_query from the plugins list, and syntax-check the result (adjust path; reload PHP-FPM or Apache after)

sudo cp -p /var/www/roundcube/config/config.inc.php /var/www/roundcube/config/config.inc.php.bak-$(date +%F) && sudo sed -i "s/'virtuser_query'[[:space:]]*,\{0,1\}//" /var/www/roundcube/config/config.inc.php && php -l /var/www/roundcube/config/config.inc.php

Prompts for the agent you already run

To check a server or fleet for exposure

Audit this host for Roundcube CVE-2026-48842. Find every Roundcube install by locating program/include/iniset.php and read RCMAIL_VERSION from each. For each install, grep config/config.inc.php (and /etc/roundcube/ on Debian-style installs) for virtuser_query in the plugins array or as a config key. Report a table: path, version, whether virtuser_query is enabled, and whether the version is below 1.6.16 (1.6 branch) or 1.7.1 (1.7 branch). Show every command you ran and its output. Do not modify any file, restart any service, or install anything.

To remediate a vulnerable install

Remediate Roundcube CVE-2026-48842 on this host. First show me the install path, current version, and the plugins array from config.inc.php. Propose a plan: back up the web root and the Roundcube database, download roundcubemail 1.6.16 or 1.7.1 (matching the current branch) from the official GitHub releases, verify it, and run bin/installto.sh against the install path. If this is a distro package, stop and tell me which package version carries the fix instead of using the tarball. Show every command before running it and stop for my approval before any backup overwrite, installto.sh run, config edit, or service restart.

What to alert on

Alert on SQL errors raised during the login flow: Roundcube's logs/errors.log (or syslog when log_driver is syslog) records DB Error lines, and a burst of syntax errors tied to the virtuser_query lookup on POST requests to ?_task=login from a single source is the clearest signal of injection attempts. Pair it with reverse proxy or WAF request body logging on the _user field of login POSTs, flagging values containing backslashes, quotes, SQL keywords such as UNION or SLEEP, or comment sequences, since standard web access logs do not capture POST bodies. On the database side, enable query or slow logging for the Roundcube account and alert on queries against the users or identities tables that did not originate from normal login volume.

Questions about your exposure?

RedEye Security provides assessments for organizations that need to understand their real risk.

Talk to us